From a196aaa2a97b6ce23e6ec4c5d5fad30c65a22034 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Wed, 4 Nov 2015 18:17:07 +0000 Subject: [PATCH] Fixed that Issues API may disclose changesets that are not visible (#21136). git-svn-id: http://svn.redmine.org/redmine/trunk@14794 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/views/issues/show.api.rsb | 4 ++-- test/integration/api_test/issues_test.rb | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/app/views/issues/show.api.rsb b/app/views/issues/show.api.rsb index f057b4c63..577a885c2 100644 --- a/app/views/issues/show.api.rsb +++ b/app/views/issues/show.api.rsb @@ -40,14 +40,14 @@ api.issue do end if include_in_api_response?('relations') && @relations.present? api.array :changesets do - @issue.changesets.each do |changeset| + @changesets.each do |changeset| api.changeset :revision => changeset.revision do api.user(:id => changeset.user_id, :name => changeset.user.name) unless changeset.user.nil? api.comments changeset.comments api.committed_on changeset.committed_on end end - end if include_in_api_response?('changesets') && User.current.allowed_to?(:view_changesets, @project) + end if include_in_api_response?('changesets') api.array :journals do @journals.each do |journal| diff --git a/test/integration/api_test/issues_test.rb b/test/integration/api_test/issues_test.rb index 5a7d64d47..4fc17fe13 100644 --- a/test/integration/api_test/issues_test.rb +++ b/test/integration/api_test/issues_test.rb @@ -336,6 +336,20 @@ class Redmine::ApiTest::IssuesTest < Redmine::ApiTest::Base end end + test "GET /issues/:id.xml should not disclose associated changesets from projects the user has no access to" do + project = Project.generate!(:is_public => false) + repository = Repository::Subversion.create!(:project => project, :url => "svn://localhost") + Issue.find(1).changesets << Changeset.generate!(:repository => repository) + assert Issue.find(1).changesets.any? + + get '/issues/1.xml?include=changesets', {}, credentials('jsmith') + + # the user jsmith has no permission to view the associated changeset + assert_select 'issue changesets[type=array]' do + assert_select 'changeset', 0 + end + end + test "POST /issues.xml should create an issue with the attributes" do payload = <<-XML -- 2.39.5